Privacy policy
Last updated: 21 Oct 2026, Version 2026-10-21-ads
This policy explains how Selo Corp (“we”) processes personal data when you use Testerloop (the website, the web application and related emails). It is written to meet the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the EU General Data Protection Regulation (“GDPR”). Turkish users can also read the separate KVKK notice.
1. Data controller
- Name: Selo Corp
- Email: selocorp@outlook.com
2. Data we process
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Email address, display name, Google account name if you sign in with Google | You |
| Account and preferences | Language, email preferences, plan, reputation score, accepted terms version | You / the service |
| Usage content | Watchlist, saved searches, test requests, test participations, daily check-ins, feedback, reports | You |
| Test squads | App name, package and test link, proof questions (answers stored only in normalised form), daily check-ins, points, feedback, in-app notifications; your Google Play email if you choose to share it with your squad | You / the service |
| Transactions | Credit movements; subscription plan, status, renewal date, Lemon Squeezy customer and subscription IDs | The service / Lemon Squeezy |
| Consent evidence | What you accepted, version, time, a salted hash of your IP address, browser user agent | The service |
| Security | Rate-limit counters keyed by account, bot-protection signals (Cloudflare Turnstile), server logs | The service / providers |
| Requests to us | Data-subject requests and our replies | You |
We do not collect payment card details — Lemon Squeezy processes payments on its own pages. We do not process special categories of personal data (health, religion, biometrics, etc.) and we ask you not to put such data in free-text fields.
Public store data. Testerloop collects app information that is publicly published on the App Store and Google Play (app name, developer name, icon, category, rating, review count, release date, rank). When a developer publishes under a personal name, that name may be personal data. It was made public by the developer, and we process it to provide market research (KVKK art. 5/2-d and 5/2-f; GDPR art. 6(1)(f)). Developers can object at any time via data requests.
3. Purposes and legal bases
| Purpose | KVKK legal basis | GDPR legal basis |
|---|---|---|
| Creating and running your account; radar, watchlist, alerts and the testing community | Art. 5/2-c (contract) | Art. 6(1)(b) |
| Subscriptions, credits and invoicing | Art. 5/2-c (contract), 5/2-ç (legal obligation) | Art. 6(1)(b), 6(1)(c) |
| Service emails you configured (saved-search digests, account emails) | Art. 5/2-c (contract) | Art. 6(1)(b) |
| Security, fraud and abuse prevention, rate limiting, moderation | Art. 5/2-f (legitimate interest) | Art. 6(1)(f) |
| Keeping proof of consents and answering data requests | Art. 5/2-ç (legal obligation), 5/2-e (establishing/defending rights) | Art. 6(1)(c), 6(1)(f) |
| Running test squads: matching, daily check-ins, points, reminders by email and in the app | Art. 5/2-c (contract) | Art. 6(1)(b) |
| Sharing your Google Play email with your squad | Art. 5/1 (explicit consent) | Art. 6(1)(a) |
| Ads on the free plan with advertising cookies (Google AdSense) | Art. 5/1 and 9 (explicit consent via the cookie banner) | Art. 6(1)(a) |
| Product news and offers by email | Art. 5/1 (explicit consent) | Art. 6(1)(a) |
Explicit consent is optional and never a condition for using the service. You can withdraw it at any time in Settings → Privacy & data; withdrawal does not affect processing done before.
4. Automated processing
The testing community uses automated rules: testers without a check-in for 3 days are removed from a test, submissions without a decision for 3 days are approved automatically, and abandoned or rejected tests lower the reputation score, which can limit joining new tests. These rules have no legal effect on you. You can object to an outcome and ask for human review through a data request.
5. Who receives your data
We share data only with service providers that process it on our instructions (processors):
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and file storage | EU (Frankfurt, Germany); company in the USA |
| Vercel Inc. | Application hosting and delivery | EU (Frankfurt) and global edge network; USA |
| Lemon Squeezy LLC | Merchant of record: payments, invoicing, tax | USA |
| Resend Inc. | Transactional email delivery | USA |
| Cloudflare Inc. | Bot protection (Turnstile) | USA and global network |
| Google LLC | Optional “Sign in with Google” | USA |
| Google Ireland Ltd. / Google LLC (AdSense) | Ads on the free plan, only with your cookie consent (independent controller) | EU (Ireland) and USA |
| GitHub Inc. | Scheduled data collection jobs (no user data) | USA |
Inside the community, other users see your display name and reputation. Owners of a test request see the display name, check-in count and feedback of people who join it. In a test squad, members see each other’s display name, app, test link, points and daily progress; your Google Play email is shown only to the members of your squad, only after it locks and only if you agreed when joining (explicit consent; withdraw it by leaving before the squad locks or by writing to us). Your sign-in email is never shown to other users. We may disclose data to authorities when required by law. We do not sell personal data.
6. International transfers
Our database runs in the EU (Frankfurt). Some providers are based in, or access data from, the United States. Transfers from Türkiye are made under KVKK art. 9 using the standard contracts published by the Personal Data Protection Board, notified to the Board as required. Transfers from the EU/EEA rely on the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.
7. Retention
| Data | Retention | Afterwards |
|---|---|---|
| Account and profile | While the account is open | Deleted immediately on account deletion; purged from backups within 30 days |
| Watchlist, saved searches, credits, community content | While the account is open; closed test requests 2 years after closing | Deleted |
| Consent records | While the account is open | Deleted with the account |
| Data requests and our replies | 3 years after the request is closed (proof of compliance) | Deleted |
| Payment and invoice records | 10 years (Turkish Commercial Code art. 82, Tax Procedure Law art. 253) | Deleted |
| Google Play email shared with a squad | Until 30 days after the squad ends | Deleted automatically |
| In-app notifications | 90 days | Deleted automatically |
| Moderation reports | 2 years after resolution | Deleted |
| Rate-limit counters | 2 days | Deleted automatically |
| Server and email delivery logs | Usually up to 30 days at the provider | Deleted by the provider |
8. Security
- Encryption in transit (TLS/HSTS) and at rest at our database provider.
- Row-level security on every table; users can only read their own records, sensitive changes run in audited database functions.
- Least-privilege keys: the service key is used only on the server; IP addresses in consent records are stored as salted hashes.
- Bot protection, rate limits, strict content-security policy and signed payment webhooks.
- In a personal-data breach we notify the Personal Data Protection Board within 72 hours and inform affected people as required by KVKK art. 12 and GDPR art. 33–34.
9. Your rights
Under KVKK art. 11 and GDPR art. 15–22 you can:
- learn whether your data is processed and request information about it;
- learn the purpose of processing and whether it is used accordingly;
- know the third parties in Türkiye or abroad to whom data is transferred;
- ask for correction of incomplete or inaccurate data, and for deletion or destruction;
- ask that corrections and deletions be notified to recipients;
- restrict processing, receive your data in a portable format (GDPR) and object to processing based on legitimate interest;
- object to a result against you arising exclusively from automated analysis;
- claim compensation for damage caused by unlawful processing;
- withdraw consent at any time.
Use Settings → Privacy & data to download your data, change consents or send a request, or see data requests for other channels. We reply within 30 days, free of charge. You can complain to the Personal Data Protection Board (kvkk.gov.tr) or, in the EU/EEA, to your local supervisory authority.
10. Children
Testerloop is for people aged 18 or older. We do not knowingly process data of children; if you think a child has an account, contact us and we will delete it.
11. Cookies
Strictly necessary cookies are always on; advertising cookies on the free plan are used only with your consent. See the cookie policy.
12. Changes
If this policy changes materially we update the version date above and ask you to review it the next time you sign in.